Failed CISA? Exactly What to Do Next (2026)

I Failed CISA: What Should I Do Next?

The scaled score came back under 450 and the word on the report was “fail”. You have probably already done the maths on what the second attempt costs, and you are probably somewhere between wanting to book it tonight and not wanting to think about it for a month.

Neither instinct is useful yet. Here is what the number actually means, what ISACA’s rules let you do, and how to spend the waiting period so the second attempt is different from the first.

Direct answer

You can retake CISA. ISACA allows four attempts in a rolling year — the initial attempt and three retakes — with a waiting period that grows: 30 days before the second attempt, then 90 days before the third and 90 again before the fourth. Each attempt requires a new exam registration at full price.

Your first job is not booking. It is working out which of two very different problems you have: you did not know enough, or you knew enough and answered badly. The remedies point in opposite directions.

What failing CISA actually means

CISA is not a knowledge quiz with a pass mark set at “most of it”. It is a judgement exam wearing the clothes of a knowledge exam. Almost every question gives you four options that are all true statements about IT audit. Three of them are things an auditor might reasonably do. One of them is what an auditor should do first, or best, or most effectively given the specific scenario in front of you.

That structure has a consequence that catches experienced people out: you can know the material thoroughly and still fail, because knowing the material is not the skill being measured. The skill being measured is choosing between defensible options under time pressure, using ISACA’s priorities rather than your own organisation’s.

So a failed attempt does not mean you are not ready to be an IS auditor. Plenty of competent, practising auditors fail CISA on the first attempt for exactly the reason above. What it does mean is that something in your preparation did not match what the exam asks for — and until you work out what, a second attempt is a second roll of the same dice.

The first 48 hours

Do not open a textbook. Do this instead, while your memory of the exam is still fresh:

Write down every question that felt uncertain. Not the content — you are not allowed to reproduce exam questions, and you do not need to. Write the shape: “a scenario where two controls both looked defensible”, “a question where I was choosing between ‘report to management’ and ‘test the control’”, “three questions in a row about business continuity where I could not tell which phase they meant”. Ten minutes of this is worth more than a week of rereading.

Then classify each one. Did you not know the material, or did you know it and pick the wrong best answer? Be honest. Most CISA candidates who fail narrowly are in the second group, and most of them believe they are in the first.

Then note your pacing. Where were you at the halfway mark? Did you finish with time to review, finish exactly on the buzzer, or guess the last stretch? Write the number down now; in four weeks you will not remember it, and it is one of the few hard facts you have about your own attempt.

Then stop for a few days. The waiting period is 30 days minimum. There is no version of this where cramming on day two helps.

What the score actually says

ISACA scores its exams on a scaled range of 200 to 800, with 450 always the passing mark for every version of the exam.

That “always” is load-bearing. The raw number of questions you need right varies between exam versions — a harder version has a lower passing raw score — but it is converted so that 450 means the same level of performance whatever version you sat. A 430 on a hard form and a 430 on an easy form represent the same gap.

Source: ISACA, “How is my Certification exam scored?”, retrieved 17 September 2026.

So the scaled score is comparable across attempts. If you scored 430 in March and 435 in June, you did not have bad luck with a harder paper. You are 15 points short, twice — and that is information, not misfortune.

What the report does not tell you is how many questions you missed, or by how much you missed each domain. You get a scaled total and a domain breakdown by relative performance. Treat the weakest domain as a direction to look, not a measured gap.

This distinction matters more than it sounds. A domain sitting at the bottom of your ranking might have been two questions short or fifteen. If you rebuild your whole study plan around it, you may spend four weeks closing a small gap while a larger one in a middle-ranked domain stays exactly where it was. The ranking tells you where to start looking. It does not tell you where to stop.

ISACA’s retake rules, exactly as published

ISACA governs retakes with an attempt ceiling and a waiting period that both apply:

Attempts: four in a rolling year — the initial attempt plus three retakes. ISACA’s own instruction: calculate from your most recent exam date and count every attempt within the last 365 days.

Waiting periods:

Retake	You must wait
Retake 1 (attempt 2)	30 days from the date of the first attempt
Retake 2 (attempt 3)	90 days after the date of the second attempt
Retake 3 (attempt 4)	90 days after the date of the third attempt

Registration: a new exam registration must be purchased for each attempt.

Source: ISACA Support, “Exams: Exam Retake Policy”, updated 21 August 2026.

Note the shape of it: the jump is from 30 straight to 90. There is no 60-day middle step the way there is at ISC2. If your second attempt fails, you are out for three months — which makes the quality of the second attempt much more important than its speed.

It is worth doing the arithmetic on the worst case once, because it changes how you treat attempt two. Fail in January, retake at the end of February, fail again, and your third sitting is not available until late May. Fail that, and the fourth is in late August. Four attempts fit inside a year on paper; in practice that year contains three long waits and four registration fees, and candidates who get there are almost never candidates who diagnosed the problem correctly after attempt one.

What a retake costs

A retake is a fresh registration at list price:

• Exam fee: $760
• ISACA member price: $575 — the vendor charges members less for the same exam

Source: ISACA CISA credential page. Local taxes and rescheduling fees are billed separately by the test provider.

If you are not already a member, do the arithmetic before you rebook rather than after. ISACA lists Professional membership at US$145 a year plus local chapter dues, and notes that members are required to join their local chapter unless one does not exist in their area — so the chapter component is real but varies by location and is not published centrally.

Source: ISACA, “Become a Member”, retrieved 17 September 2026.

The $185 saving on a single retake is larger than the international dues figure on its own. Whether it is larger than dues plus your chapter’s fee depends on where you are, which is why this is a calculation about your own circumstances rather than advice. Check what your local chapter charges before you decide.

Two attempts at the non-member price is $1,520. Worth knowing before you treat the retake as a quick second roll of the dice.

Why people fail CISA — and which one is you

CISA covers five domains: the Information Systems Auditing Process; Governance and Management of Information Technology; Information Systems Acquisition, Development and Implementation; Information Systems Operations and Business Resilience; and Protection of Information Assets. Most failures cluster into four patterns that cut across all five.

The auditor’s-experience trap. You have done this work. You know what your organisation does when a control fails. CISA is not asking what your organisation does; it is asking what an IS auditor should do according to standards. Experienced auditors fail on questions where their real-world answer is sensible and not the one the exam wants — typically because the real-world answer involves fixing something, and the exam’s answer involves documenting and reporting it.

Answering the question you expected. CISA scenarios are long and several options are defensible. Candidates lock onto a keyword, decide what the question is about, and answer that instead of what was asked. The classic version is choosing a remediation step when the question asked what the auditor should do first. The second most common is answering “what is the greatest risk” with the item that sounds most alarming rather than the one with the greatest business impact in that scenario.

Genuine coverage gaps. Protection of Information Assets and Operations and Business Resilience both carry weight that candidates from a pure audit-process background underestimate, and the auditing process domain carries weight that candidates from an operations background underestimate. Whichever side you came from, the other side is where your gap probably is.

Pacing. Running out of time and guessing the last stretch produces a failing score that looks like a knowledge problem and is not one. This is why you wrote down your halfway mark in the first 48 hours: if you were behind at the midpoint, no amount of additional reading fixes your score.

Only the third one is fixed by studying more. The other three are fixed by changing how you answer, and studying more can make them worse — more material means more plausible-looking options.

A 30-day retake plan that is not a reread

Week 1 — diagnose, do not study. Work through practice questions in the domains your report ranked lowest. For every one you get wrong, write a single sentence explaining why the correct answer is better than yours. If that sentence comes easily, you had a reading problem. If it does not, you have a knowledge gap. You now know which plan you are on.

Do this with at least sixty questions before you draw a conclusion. Ten questions is a mood, not a diagnosis.

Week 2 — attack the actual problem.

Knowledge gap: work the weak domains at the level of principle, not memorisation. CISA rewards knowing why a control exists over knowing its name. For every control you study, be able to say what risk it addresses, what evidence would show it is working, and what an auditor would do if the evidence were missing. If you can answer those three, you know it well enough for the exam.

Reading problem: stop learning new material entirely. Do questions and, before looking at the options, write down what the question is asking for — first step, best control, greatest risk, primary concern. Then pick. This feels artificial for about two days and then becomes automatic, which is the entire point.

Week 3 — full-length, timed, no interruptions. Two of them, several days apart. Review every wrong answer and every right answer you were unsure of. The second group is where your remaining risk lives: on exam day those become coin flips, and a failing score is usually built out of coin flips rather than out of things you flatly did not know.

Sit them at the time of day your exam is booked for. If your appointment is at 8am and all your practice is at 10pm, you have not rehearsed the conditions.

Week 4 — taper. Light review, no new material, and sleep. Candidates who cram in the final week reliably underperform their practice scores, and the mechanism is not mysterious: the exam is four hours of sustained judgement, and judgement is the first thing fatigue takes.

What not to do

Do not rebook on day 31 by default. The rule says you may sit after 30 days, not that you should. If week 3’s timed attempts are not comfortably above your last score, take the extra fortnight. A second failure costs $760 and three more months.

Do not switch study materials wholesale. Starting a new course in week 1 means spending your best two weeks on material you have already covered, dressed differently. Add a question bank if you need more practice items; do not replace your foundation.

Do not treat the domain ranking as a percentage. It is an order, not a measurement. Rebuilding everything around the bottom-ranked domain is how candidates fix a 10-point gap in one area while a 20-point gap opens in another.

Do not go quiet about it. If your employer is paying, tell them now and with a plan. “I missed by 20 points, here is my 30-day plan, here is the retake date” lands very differently from a silence followed by a second invoice.

Do not sit the retake to prove something. Booking out of frustration is how attempt two becomes a more expensive copy of attempt one. The only good reason to pick a date is that your timed practice says you are over the line.

The part nobody writes about

A failed professional exam lands harder than it should, and pretending otherwise does not help. You told people you were sitting it. You may have had a date in mind for the certification going on your profile. There is a specific and unpleasant week after a failure where the sensible thing — wait, diagnose, plan — feels like doing nothing.

Two things are worth knowing. The first is that pass rates on second attempts are meaningfully better than on first attempts for candidates who change their method, and meaningfully not better for candidates who just study longer. The difference between those two groups is a decision you make in week 1, not effort you apply in week 3.

The second is that nothing about the failure follows you. ISACA does not annotate your certification with the number of attempts. Once you pass, the record says you are a CISA, and there is no field anywhere that says how long it took.

Turning the first attempt into an advantage

You now have something a first-time candidate does not: direct evidence of how this exam behaves. Use it deliberately.

You know the question style, so practice questions should now feel familiar rather than novel. You know your own pacing under real conditions, so your timed practice has a target to beat rather than a guess. You know which domains sat at the bottom of your report. And you know, from the ten minutes you spent in the first 48 hours, which shapes of question made you hesitate.

That last one is the most valuable and the most perishable, which is why it comes first in the plan. Candidates who skip it arrive at week 2 with nothing but a domain ranking and end up studying the whole syllabus again at slightly higher intensity.

Study group or solo

ISACA runs member-only online study groups for CISA candidates, and local chapters often run their own sessions. Whether that helps you depends on which diagnosis you landed on.

If you have a knowledge gap, a group is genuinely useful: explaining a control to someone else is the fastest way to find out whether you understand it or merely recognise it.

If you have a reading problem, a group can actively hurt. Group discussion tends to converge on “what is the right answer” rather than “why is this the best answer given what was asked”, and you need the second one. Work questions alone, write your one-sentence justifications alone, and bring only the ones you cannot resolve to the group.

Where Certsqill fits

Certsqill has 496 CISA practice questions, each with an explanation for every option — including why the three wrong ones are wrong — plus a readiness score per domain.

That is aimed squarely at the diagnosis in week 1. Reading why a plausible answer is not the best answer is the specific skill CISA tests and the one that a reread of the review manual does not build. The per-domain readiness score also gives you the percentage ISACA’s report leaves out, which is what turns a ranking into something you can actually plan against.

Try 20 questions free and see which of the two problems you actually have.

FAQ

How soon can I retake CISA? 30 days from the date of your first attempt. After a second failure, 90 days from that attempt, and 90 again after a third.

How many times can I take CISA in a year? Four — the initial attempt plus three retakes — counted over a rolling 365 days from your most recent attempt.

Do I pay again? Yes. ISACA requires a new exam registration for every attempt: $760, or $575 for members.

Is ISACA membership worth it just for the retake discount? The exam saving is $185. ISACA lists Professional membership at US$145 a year plus local chapter dues, and chapter dues vary by location. Check what your chapter charges before deciding — the answer is genuinely different in different places.

Does failing affect my CISA application later? No. Failed attempts do not appear on your certification once you pass, and they do not affect the work-experience requirements.

Will I see the same questions? No. Expect a different set drawn from ISACA’s item pool.

Is 450 a percentage? No. It is a scaled score on a 200–800 range. It does not correspond to a fixed percentage of questions answered correctly, because the raw passing score varies with the difficulty of the exam version.

Can I find out which questions I got wrong? No. ISACA does not release item-level results. The domain breakdown is the most granular feedback you get, and it is relative rather than absolute.

Related Articles

• → CISA Retake Rules: Wait Time, Cost & Reset Policy
• → How to Read Your CISA Score Report
• → Scored Low on CISA? How to Pass the Retake
• → CISA Retake Strategy: Building the Second Attempt
• → What CISA Mock Scores Say About Readiness